{
	"id": "d09dfeab-0860-46bb-a279-6f13c3af44d7",
	"created_at": "2026-04-06T00:22:23.108085Z",
	"updated_at": "2026-04-10T03:30:01.830096Z",
	"deleted_at": null,
	"sha1_hash": "2259d6b7629b4f9b238dd8522caac8b80dcc42fe",
	"title": "Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 53693,
	"plain_text": "Threat Group Cards: A Threat Actor Encyclopedia\nArchived: 2026-04-05 20:28:48 UTC\nHome \u003e List all groups \u003e List all tools \u003e List all groups using tool Gon\n Tool: Gon\nNames Gon\nCategory Malware\nType Reconnaissance, Remote command, Info stealer, Exfiltration\nDescription\n(Palo Alto) At a high level, the Gon tool allows the actor to scan for open ports on remote\nsystems, upload and download files, take screenshots, find other systems on the network, run\ncommands on remote systems and create a Remote Desktop Protocol (RDP) session. The actor\ncan use Gon as a command-line utility or by using a Graphical User Interface (GUI).\nInformation\nLast change to this tool card: 29 April 2020\nDownload this tool card in JSON format\nAll groups using tool Gon\nChanged Name Country Observed\nAPT groups\n xHunt 2018-Aug 2019\n1 group listed (1 APT, 0 other, 0 unknown)\nSource: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=fd4ddff0-6e52-43bd-88bf-2b6dcdcbb5d8\nhttps://apt.etda.or.th/cgi-bin/listgroups.cgi?u=fd4ddff0-6e52-43bd-88bf-2b6dcdcbb5d8\nPage 1 of 1",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=fd4ddff0-6e52-43bd-88bf-2b6dcdcbb5d8"
	],
	"report_names": [
		"listgroups.cgi?u=fd4ddff0-6e52-43bd-88bf-2b6dcdcbb5d8"
	],
	"threat_actors": [
		{
			"id": "20bc5b83-9ea0-4e60-a23e-19bf203dc9fb",
			"created_at": "2022-10-25T16:07:24.432777Z",
			"updated_at": "2026-04-10T02:00:04.986077Z",
			"deleted_at": null,
			"main_name": "xHunt",
			"aliases": [
				"Cobalt Katana",
				"Hive0081",
				"Hunter Serpens",
				"SectorD01"
			],
			"source_name": "ETDA:xHunt",
			"tools": [
				"CASHY200",
				"COLDTRAIN",
				"Gon",
				"Hisoka",
				"Killua",
				"Netero",
				"SHELLSTING",
				"Sakabota",
				"Snugy",
				"TriFive"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434943,
	"ts_updated_at": 1775791801,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/2259d6b7629b4f9b238dd8522caac8b80dcc42fe.pdf",
		"text": "https://archive.orkl.eu/2259d6b7629b4f9b238dd8522caac8b80dcc42fe.txt",
		"img": "https://archive.orkl.eu/2259d6b7629b4f9b238dd8522caac8b80dcc42fe.jpg"
	}
}